HIPAA Privacy Notice

COMPSYCH CORPORATION

Notice of HIPAA Privacy Practices (Effective August 1, 2022; Revised November 2024)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

ComPsych Corporation is committed to maintaining the confidentiality of all information it receives. ComPsych is required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) to maintain the privacy of Protected Health Information ("PHI") and to provide all individuals with notice of ComPsych's legal duties and privacy practices with respect to PHI. ComPsych has implemented administrative, technical, and physical data security practices designed to protect the confidentiality and integrity of your PHI. In addition to providing you with information about how ComPsych may use and disclose PHI, this notice also describes your rights related to your PHI and informs you of how to contact ComPsych. ComPsych will abide by the terms set forth in this Notice. Please note that by registering on our website or by using the services provided by ComPsych, you accept the privacy practices described in this Notice.

 

In order to provide you with requested Employee Assistance Program (“EAP”) services, ComPsych may collect identifying information such as your name, address, email and phone number, along with information about your physical and mental health, outcomes, and other personal information. If you communicate with ComPsych via mail, email, online chat or asynchronous chat, we collect this information to provide EAP services to you. Your information is retained for as long as is necessary to provide EAP services and to comply with legal and regulatory requirements.

 

Uses and Disclosure of PHI Without Your Authorization

Your PHI will be used by ComPsych to ensure that you receive the EAP services covered by your benefit plan. ComPsych may use or disclose PHI as described below without your authorization for purposes of treatment, payment or health care operations. The following are examples of how information is used and disclosed for such purposes:

  • Your PHI may be used and disclosed by ComPsych and others who are involved in your care for purposes of providing, coordinating or managing your care and any related services. This includes coordination or management of your health care with a third party, consultation with other health care providers or referral to another provider for health care treatment.
  • ComPsych may use and share your PHI to run our company, improve your care, and contact you when necessary. 
  • ComPsych may disclose your PHI to Business Associates who provide services to us on our behalf. Business Associates are contractually required to protect your PHI and comply with HIPAA. 
  • Outside auditors and other third parties may gather various information from ComPsych to track the quality of services ComPsych provides.
  • The following are other circumstances where ComPsych may be required to disclose your PHI without your authorization:


1) To comply with applicable law;

2) for specified public health activities and purposes;

3) for health oversight activities;

4) in judicial or administrative proceedings in response to a legal order or other lawful process;

5) to the police or other law enforcement officials as required by law or in compliance with a court    order or other process authorized by law;

6) to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public;

7) to units of the government with special functions, such as the U.S. military or the U.S. Department of State; or

8) as necessary to comply with workers' compensation laws.

 

Uses and Disclosure of PHI that Require Your Authorization

Except as otherwise indicated in this Notice, ComPsych's use or disclosure of your PHI will be made only with your written authorization.

More specifically ComPsych must obtain your authorization for uses and disclosures of:

1) psychotherapy notes with limited exceptions;

2) PHI made for marketing purposes;

3) PHI for which ComPsych may receive payment;

4) certain PHI that is “highly confidential information” such as information about mental health and        developmental disabilities, substance use disorder treatment records, genetic testing and HIV/AIDS, and

           (5) information about reproductive health issues, such as sexually transmitted diseases or pregnancy.

If you do provide authorization for use or disclosure of the PHI listed above or any other disclosure not specifically permitted in this Notice of Privacy Practices, you have the right to revoke such authorization at any time to stop any future uses and/or disclosures. Any revocation will not apply to disclosures made prior to the revocation.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to assist you.

  • Right to Access PHI. You have the right to request to inspect or receive an electronic or paper copy of your PHI that ComPsych maintains. Under certain circumstances, ComPsych may deny your request. ComPsych may charge a reasonable fee for all costs associated with your request.
  • Right to Correct or Update PHI. You have the right to request that ComPsych correct or update your PHI maintained by ComPsych that you believe is incorrect or incomplete. Your request must be in writing and include the reason you are making the request. Under certain circumstances, ComPsych may deny your request. We will do so in writing.
  • Right to an Accounting of Disclosures. You have the right to request an accounting of disclosures of your PHI for six years prior to the date of your request.  This accounting will not include disclosures that were made for purposes of treatment, payment or health care operations, or disclosures made pursuant to your authorization or disclosures to you. Your request must state the specific time period you are requesting an accounting for. The first accounting you request in any 12 month period shall be provided at no cost. For any additional requests, ComPsych may charge a reasonable fee.
  • Right to Request Confidential Communications. You have the right to request that ComPsych communicate with you in a specific manner (for example, home or office phone) or to send mail to a different address. Such a request must be in writing and specify your communication preference. 
  • Right to Request Restrictions. You have the right to ask us not to use or share certain PHI for treatment, payment, or our operations. We are not required to agree to your request and may deny your request if it would affect your care. You also have the right to restrict certain disclosures of PHI to a health plan where you pay out of pocket, in full, for the healthcare item or service. ComPsych may deny your request if the law requires us to share the information. All requests must specifically state what information you want to limit and to whom the limitation applies.
  • Right to Breach Notification. You have the right to be notified following a breach of your unsecured PHI, unless we can demonstrate, based on a risk assessment that there is a low probability that the PHI has been compromised. 
  • Right to Receive a Copy of this Privacy Notice. You have the right to receive a paper or electronic copy of this Notice.
  • Right to Choose Someone to Act for You. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. 
  • Right to File a Complaint if You Feel Your Rights are Violated. If you believe that your privacy rights have been violated, you may contact ComPsych directly or the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against for reporting a violation of your privacy rights.

Records Related to Reproductive Health

Reproductive healthcare includes all healthcare matters related to the reproductive system or to its functions and processes. PHI related to reproductive healthcare will be protected under HIPAA like all other PHI. However, there are additional protections in place for PHI related to reproductive health care. Subject to the provisions below, ComPsych will not use or disclose PHI when the request for the use or disclosure of PHI is made to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.  Specifically, ComPsych will not use or disclose PHI when the request for such use or disclosure is for either of the following activities:

  • To conduct a criminal, civil, or administrative investigation into, or impose criminal, civil, or administrative liability on any person for, the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided.
  • The identification of any person for the purpose of conducting such investigation or imposing such liability.

ComPsych will presume that reproductive healthcare provided by another party is lawful unless it has actual knowledge or the party requesting the use or disclosure of PHI provides information demonstrating a substantial factual basis that the reproductive healthcare in question is not lawful.

 

Before using or disclosing PHI potentially related to reproductive healthcare, ComPsych will secure a signed attestation from the requesting party that the use or disclosure is not for one of the prohibited purposes outlined above. This attestation requirement applies when the request is made under any of the following permissions:

  • Disclosures for health oversight activities;
  • Disclosures for judicial and administrative proceedings;
  • Disclosures for law enforcement purposes;
  • Disclosures about decedents to coroners and medical examiners; judicial and administrative proceedings;
  • law enforcement purposes; and
  • disclosures to coroners and medical examiners.

 

Contact

If you need further information about matters covered by this Notice, all requests must be sent to ComPsych’s Privacy Official through electronic or written communication. Please document your request and send it to ComPsych via email: records@compsych.com or mailed to: ComPsych Corporation, 455 N. Cityfront Plaza Drive, 13th Floor, Chicago, IL 60611, Attn: Privacy Official. For urgent matters, you may call 312-660-1076 in addition to submitting your documented request.

Si require que este documento sea traducido, comuniquese al numero 1-888-664-4225.

ComPsych reserves the right to change its privacy practices at any time and any such change shall apply to all PHI ComPsych maintains, including information created or received by ComPsych prior to issuing a new Notice. If ComPsych materially changes its privacy practices, this Notice shall be amended and disseminated to all individuals.

Revised November 2024